Hide unsafe settings in about:preferences

Issues:

• Firefox Home Content ( about:preferences#home )

added Feature label

added Desktop label

added Q1 label

added Backlog label

added Sponsor 131 label

marked this issue as related to tor-browser#40656

assigned to @dan

@dan I've assigned this issue since you're doing the public counterpart .

changed the description

added Next label and removed Backlog label

mentioned in issue #21 (closed)

assigned to @pierov and unassigned @dan

assigned to @richard and unassigned @pierov

removed Next label

added Doing label

@dan's MR to work from: tor-browser!538 (closed)

assigned to @pierov and unassigned @richard

removed Doing label

added Next label

In addition to the home settings, we found:

• browser.download.useDownloadDir
• Passwords and forms (which should be already be hidden, have to double check)
• Search suggestions
• Windows SSO (already hidden with another patch)
• Phishing and malware protection (in the privacy panel): we don't want them because they involve reaching out to Moz, IIRC
• Extension recommendations (don't remember what I meant, probably that we don't want to show "recommended" , especially because it says "recommended by Mullvad Browser", when it's actually "recommended by Mozilla")

Not audited, but disabled by default:

• Picture in picture (not sure where's the harm here...)
• Media keys controls (PBM vs. non-PBM: PBM already says "Firefox is reproducing some media", so I'd be up to keep this)

@ruihildt did you want us to hide additional settings?

In "General":

• Mullvad Browser Updates? Now it links to Mozilla, but if we get the same system as the Tor Browser, then it's fine.

In "Search":

• Find more search engines (This is a link to a category which is a weird mix of extensions, you might want to remove it in Tor Browser too)

Now it links to Mozilla, but if we get the same system as the Tor Browser, then it's fine.

Let me check. It could be a preference that for some reason we set in Tor Browser only, probably app.releaseNotesURL:

pref("app.update.notifyDuringDownload", true);
pref("app.update.url.manual", "https://www.torproject.org/download/languages/");
pref("app.update.url.details", "https://www.torproject.org/download/");
pref("app.update.badgeWaitTime", 0);
pref("app.releaseNotesURL", "about:blank");
// disables the 'What's New?' link in the about dialog, otherwise we need to
// duplicate logic for generating the url to the blog post that is already more
// easily found in about:tor
pref("app.releaseNotesURL.aboutDialog", "about:blank");
// point to our feedback url rather than Mozilla's
pref("app.feedback.baseURL", "https://support.torproject.org/%LOCALE%/get-in-touch/");

Some of these preferences should be set to Base Browser and Mullvad Browser, too (especially the ones not related to torproject.org).

Find more search engines (This is a link to a category which is a weird mix of extensions, you might want to remove it in Tor Browser too)

Good idea

Extension recommendations

There are a couple of checkboxes below the PIP and media settings. Hiding them.

Opened #131 (closed) to follow on the updater prefs.

@pierov Regarding PIP, we disable it out of precaution because it has not been audited?

Yes

Thorin's wishlist is worth exploring, too: tor-browser#40656 (comment 2754805).

This fits nicely with the project of warning user when changing some settings will affect their privacy.

Yep, this list needs more UX attention, I think.

marked this issue as related to #21 (closed)

removed Next label

added Doing label

mentioned in merge request !40 (closed)

marked this issue as related to #118 (closed)

marked the checklist item Firefox Home Content ( about:preferences#home ) as completed

Firefox Home Content (about:preferences#home) seems to be populated automatically, and in our case it isn't already.

removed the relation with #118 (closed)

closed

marked this issue as related to #150 (closed)

removed Doing label

mentioned in merge request tor-browser!538 (closed)